Privacy Policy

Who we are & how Milepost is used

Milepost is operated by Armstrong Intelligence (“Milepost,” “we,” “us”), based in the United States. Milepost is a business and government tool, not a consumer app. Our customer is the employing organization — a town, village, district, or private company (the “employer”). The employer is the controller of its workforce records; Milepost processes that data on the employer’s behalf to run their timekeeping, payroll, fleet, and accountability record.

The people who use the Milepost app are the employer’s workers and supervisors. Their accounts are provisioned by their employer — Milepost does not offer public sign-up, and a worker cannot create their own account (see Accounts). If you are a worker with a question about your own data, your employer is the first point of contact; we help them fulfill your request.

What we collect

We collect only what the product needs to keep an accurate, defensible record of work. Specifically:

• Identity. Your name, work email address, job role, and the account and device identifiers Milepost assigns you. Sign-in is passwordless — we email a one-time code, so we do not store or ask for a password.
• Precise location, while you are on the clock. When you clock in, the app records this device’s location — including in the background, when the app is closed or the phone is locked — as an on-duty timekeeping trail. Location collection stops the moment you clock out, and Milepost never collects your location while you are off the clock. See How on-duty location works.
• Photos you take in the app. Vehicle pre-trip (DVIR) inspection photos and license or certification photos, when your role uses those features.
• A verification photo, only at a shared wall-station kiosk. When your organization clocks in on a shared garage tablet, it captures a photo at the moment of the punch so the office can confirm the right person clocked in, compared to a reference photo on file. It is used only to verify the punch. If the punch is approved, that photo is deleted about 30 days later — the reference photo and the record of the check are kept; if it is flagged as a mismatch, the photo is kept as evidence of the discrepancy. Clocking in from your own phone takes no such photo.
• Device information. A security key the app generates to sign your punches (so “which device recorded this time” is evidence, not a claim), the platform (iOS/Android/web), and — if you allow notifications — a push-notification token so the app can be alerted, for example, of a vehicle change.
• Work content you enter. Clock-in/out notes, the job or cost code on a shift, fuel and service logs, task and inspection entries, and, for kiosk use, a hashed wall-station PIN (we store only a one-way hash, never the PIN).

What we do not collect: we do not collect your phone number, home address, date of birth, contacts, calendar, photo library, browsing history, or any special-category data (such as race, religion, health, or sexual orientation). Milepost contains no advertising, no advertising identifier, and no third-party analytics or tracking SDKs.

How on-duty location works

Location is the most sensitive thing Milepost handles, so it is bounded deliberately:

• On the clock only. The background location trail runs only between your clock-in and your clock-out. Clock out and it stops. We do not track evenings, weekends, or time off.
• What it is for. To confirm you were at the job site, to keep an on-duty route trail if a question comes up later, and to show your position to your own organization’s supervisors on a live crew safety map. It is never shown to the public or to other organizations.
• You are asked first. Before the background trail starts, the app shows a plain-language disclosure and asks you to turn location on. If you decline, the trail simply does not run — you can still clock in, and a punch may still carry a single location reading at the moment you press the button.
• It is kept short. On-duty location breadcrumbs are an operational trail, kept separate from the tamper-evident time record, and are automatically purged about 90 days after they are captured.

This on-duty-only boundary is the line New York’s highest court drew in Cunningham v. NY State Dept. of Labor (2013): workplace GPS was upheld during work hours but struck down once it reached off-duty time. Milepost is built to that line.

How we use data

We use the data above only to provide and support the service for your employer:

• To record and verify hours worked, and to flag punches that need review (for example, off-site or from an unrecognized device).
• To prepare payroll — hours coded to the correct fund, budget line, or job — for the employer to export to their payroll system.
• To run the fleet, pre-trip, and job-costing features your organization has enabled.
• To keep a tamper-evident, exportable accountability record for the employer, its board, and its auditors.
• To secure accounts, notify devices of relevant events, and provide customer support.

We do not use your data for advertising, we do not sell or rent it, and we do not use it to build profiles for anyone other than your employer’s own operational record.

Who we share with

Milepost does not sell personal data and does not share it with third parties for their own purposes. Data is disclosed only:

• To your employer — the organization whose account you belong to, and its authorized supervisors and administrators. This is the whole point of the product: your hours and on-duty record belong to your employer.
• To service providers who process data on our behalf, under contract and only to run the service — specifically our US-based cloud hosting provider, our transactional email provider (to send sign-in codes), and the platform push-notification service (to deliver notifications). They may not use the data for any other purpose.
• When required by law, or to protect the rights, safety, and security of users and the service.

Security

Data is encrypted in transit and at rest, access is role-based, and hosting is US-based. Every change to the record is written to a per-organization, hash-chained audit trail, so tampering is detectable by mechanism rather than by trust. Punches are cryptographically signed on the device that made them.

Retention & the tamper-evident record

Milepost is an accountability system, so the time and payroll record is append-only and is not silently deleted or edited. Correcting a mistake writes a new, linked entry that explains the change; the original stays. Employers retain these records for as long as their own municipal or business records-retention obligations require.

• On-duty location breadcrumbs are purged automatically about 90 days after capture.
• Wall-station verification photos for an approved punch are deleted about 30 days after approval; a mismatch photo is kept as evidence, and the reference photo and the record of who checked the punch are always kept.
• The time and payroll record is retained by the employer per their retention rules; a worker who leaves is deactivated, not erased, so their historical time record stays attributable and auditable.

Accounts & your choices

The Milepost app does not allow users to create their own accounts. Accounts are created and managed by the employing organization’s administrator. You sign in to an account your employer has already set up, using an emailed one-time code.

You control location sharing at any time through your device’s operating-system settings — you can decline or revoke location permission, and the background trail will not run. Turning it off does not lock you out; you can still clock in.

Data access & deletion

Because accounts and records are owned and controlled by the employing organization, requests to access, correct, or delete personal data are handled through that employer. If you are a worker, contact your employer’s Milepost administrator. If you are an employer, or you cannot reach one, contact us at [email protected] and we will act on the account holder’s verified instruction.

Some records cannot be deleted on request while a legal retention obligation applies to them — a municipal time and payroll record is kept for the period the law requires, and the tamper-evident audit trail is retained so the record stays verifiable. Where deletion is not possible, we will explain why, and we will delete or de-identify data once its retention obligation ends. On-duty location breadcrumbs, which carry no such obligation, are purged on the 90-day schedule described above.

Children

Milepost is a workplace tool intended for employees and is not directed to, or intended for use by, children. We do not knowingly collect data from anyone under 16.

Changes & contact

If we change this policy, we will post the updated version here with a new effective date, and — for material changes — notify the organizations that use Milepost. Questions about this policy or your data:

• Email: [email protected]
• Phone: (607) 287-3158
• Milepost / Armstrong Intelligence, United States